Cloud Data Deduplication via Attribute-Based Encryption

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Cloud computing faces inefficiencies in managing duplicated data storage, leading to resource waste, increased operational costs, and complex data management, while existing solutions fail to effectively deduplicate encrypted data and support flexible access control and digital rights management.

Innovation Solution

The proposed solution employs attribute-based encryption (ABE) to manage keys for duplicated data storage among authorized users, using hash codes for duplication detection and personalized secret keys for decryption, allowing data owners to control access and storage, and enabling deduplication without relying on third-party key servers.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If duplicated data is stored in cloud computing, then data availability and access flexibility are improved, but storage resource waste and operational costs increase

Engineering Contradiction:
Improvedata access flexibilityVSAvoidstorage resource waste
Core Design Contradiction:
Adaptability or versatilityVSLoss of energy

Solution Approach 1:

The patent uses cryptographic copies (hash codes) of data to enable deduplication detection without storing actual data copies. When data is uploaded, a hash code is generated and stored; if the same hash code exists, the data is identified as a duplicate and not stored again. This allows the system to maintain data availability through reference to existing copies while avoiding redundant storage of actual data content.

Inventive Principle:
Principle #26Copying

2Quantity of substance

If data deduplication is implemented, then storage space is saved, but data security and access control become more complex

Engineering Contradiction:
Improvestorage spaceVSAvoidaccess control complexity
Core Design Contradiction:
Quantity of substanceVSDevice complexity

Solution Approach 1:

The patent introduces cryptographic hash codes as intermediaries between the actual data and the deduplication mechanism. Instead of directly comparing and managing large data files for deduplication, the system uses compact hash codes as proxies. These hash codes serve as unique identifiers that enable efficient duplicate detection while maintaining a clear link to the original data through cryptographic relationships, thereby simplifying the overall access control structure.

Inventive Principle:
Principle #24Intermediary (Mediator)

3Reliability

If encrypted data is stored with centralized key management, then data security is improved, but system reliability decreases due to single point of failure

Engineering Contradiction:
Improvesystem reliabilityVSAvoidkey management structure
Core Design Contradiction:
ReliabilityVSDevice complexity

Solution Approach 1:

The patent segments the centralized key management structure into distributed key components stored across multiple servers. Instead of relying on a single key server that could become a point of failure, the encryption keys are divided and stored across multiple nodes in the cloud infrastructure. This segmentation allows the system to maintain data security through cryptographic protection while improving reliability through distribution, eliminating the single point of failure.

Inventive Principle:
Principle #1Segmentation

4Loss of information

If data is encrypted before storage, then data privacy is protected, but deduplication capability is lost

Engineering Contradiction:
Improvedata privacyVSAvoiddeduplication capability
Core Design Contradiction:
Loss of informationVSProductivity

Solution Approach 1:

The patent performs preliminary cryptographic hashing of data immediately upon upload, before the data is encrypted and stored. This preliminary action creates a unique fingerprint (hash code) of the original data that can be used for deduplication detection. The hash code is generated in advance, allowing the system to identify duplicates based on this pre-computed value even after the actual data is encrypted, thereby preserving deduplication capability while maintaining data privacy through encryption.

Inventive Principle:
Principle #10Preliminary action

Data Source

PatentEP3238368B1Method and apparatus for duplicated data management in cloud computing
Publication Date: 2020.09.02 NOKIA TECHNOLOGIES OY
  • EP3238368B1 patent drawingFigure 1
  • EP3238368B1 patent drawingFigure 2
  • EP3238368B1 patent drawingFigure 3

AI summary

An approach is provided for managing data duplication in cloud computing. A method comprising, sending from a first device to a data center, data encrypted with a data encryption key for storing the encrypted data at the data center; encrypting the data encryption key according to an attribute-based encryption (ABE) scheme by using identity as an attribute in a deduplication policy for the data; issuing to a second device, a personalized secret attribute key which is derived from a public key of the second device according to the attribute-based encryption (ABE) scheme, wherein the personalized secret attribute key is to be used for decrypting the encrypted data encryption key at the second device, in combination with the policy.